Automatic GitHub action updates

[infinisil]

This is an alternative to #39. It runs the dependabot CLI locally in the existing weekly update CI action (along with some jq magic). Yet untested in CI, but It also works locally, which is really nice!

Best reviewed commit-by-commit, there's some Nix changes in the first 2 commits.

---

This work is sponsored by Antithesis ✨

[infinisil]

I renamed the check job to build because it's more accurate considering what it does. I'll have to update the branch protection to change the checks which are required before we can merge it.

[infinisil]

Nice: https://github.com/NixOS/nixpkgs-check-by-name/actions/runs/8636542602/attempts/1#summary-23676696374

[willbush]

Pretty cool! I'm learning a lot by review this code. I've never used pkgs.writeShellApplication before. Looks useful.

[infinisil]

Awesome!

Not sure if this needs to be documented anywhere since nobody will actually need to run this locally, but to make it work locally you need a Docker daemon running, which on NixOS means something like this:

{
  virtualisation.docker.enable = true;
  # The default firewall settings block inter-container networking,
  # which is needed by dependabot, so don't run the firewall on docker connections
  networking.firewall.trustedInterfaces = [ "docker0" ];
  # So that your user can access docker without being `root`
  users.users.me.extraGroups = [ "docker" ];
}

[willbush]

We're you using https://github.com/nektos/act ? (it depends on docker)

[infinisil]

Nah I'm running it locally by doing what the action does:

nixpkgs-check-by-name/.github/workflows/update.yml

Lines 19 to 20 in 44d5e2e

	nix-build repo -A autoPrUpdate
	result/bin/auto-pr-update repo > body

Or within the current directory:

$ nix-build -A autoPrUpdate
$ result/bin/auto-pr-update . > body 

E.g. try downgrading a GitHub Actions dependency and then running that

[philiptaron]

Dang Silvan, I'm learning too much. This is definitely effortful in a way that's quite impressive.

[philiptaron]

🦺 👍🏻 👀

Looks good.

[philiptaron]

Hrmph. https://github.com/NixOS/nixpkgs-check-by-name/actions/runs/8637321506/job/23679230914

[philiptaron]

Lazy derivation didn't work as expected?

[infinisil]

Ohh it did work as expected, this is actually great because it shows that we relied on .version, which was kind of internal. I'll make a PR to explicitly expose it. Edit: #41

[infinisil]

Just opened dependabot/cli#301 to hopefully have a better solution eventually :)

[infinisil]

Nice: #42